Hacker News Reader

Comment by JTenerife | Hacker News Reader

Informations about HAProxy on multi-core hardware (TLS de- and encryption are CPU bound) are a bit discouraging. You can assign workers to cores, but there's no shared memory and therefore the official docs warn about some inconsistencies that might occur. There doesn't seem to be a consensus wether to use the multi-core feature or not. Also nginx supports http/2.

Regarding the status of the backendservers - I use monitoring with health checks for every backend server anyway.

That are the reasons I chose nginx as reverse proxy recently.

View on HN

We've had great success with HAProxy on multi-core without the warnings. The Stack Exchange operations did a blog post about an easy way to do it. Here's a sample config that does multi-core processing really well: https://gist.github.com/joliver/40291313605971545a0c1f6a3040...

Does the stats endpoint reflect stats for all processes?

Yes, it aggregates stats for all endpoints.

Perhaps I mis-remembered that it would only work for one of them. Haven't used HAProxy in a while.

There is definitely a single right consensus on how to do high performance TLS load balancing (irrelevant of the software):

- Create 1 process per core and pin to a core.

- In extreme cases, pin the NIC interrupt to a dedicated core. (If you have multiple NIC, one dedicated core per NIC).

HAProxy lets you do that very easily. That's why it's configured the way it's configured, because it's the options you need to make a high performance load balancer.

Shared memory is not necessarily and would kill the performances dramatically. The "inconsistencies" you might have heard about mean that the stats in the stats page are approximate, nothing important.

Lack of http/2 on haproxy by now is terribly limiting and very disappointing.

Agreed, and I can find no roadmap for it. It's a real shame.

I'm looking at moving to something a bit more application aware now, such as Traefik, which works better in my workflow anyway.

Will say though - HAProxy has been rock solid for me, and was a million times easier to configure and manage than F5 LTM for our use case.

I wonder if that's because it may have to decode all the data going over the pipe to figure out where headers are? As it stands HAProxy only looks at and modifies HTTP headers and passes the body right on through without touching or modifying it.

Reply on news.ycombinator.com